1

How can I configure Microsoft Windows so that each time Microsoft Windows gets locked (WIN + L) it kills a specific process before the lock?

1

Using Task Scheduler, you can create a task with an "On workstation lock" trigger that runs a taskkill on your desired process.

  1. Open Task Scheduler — Either from the Start Menu by typing, or under "Windows Administrative Tools". You can also run taskschd.msc.

  2. Select Create Task... on the right-hand side.

  3. Name the Task whatever you'd like, such as "Kill myprocess on lock". Give it a description if you like.

  4. In the Triggers tab, create a new trigger. Under Begin the task, select On workstation lock

  5. In the Actions tab, create a new action. The default action should be to Start a program.

    1. In the Program/script field, enter cmd.exe
    2. In the Add arguments field, enter /c taskkill /im "myprocess.exe", replacing myprocess as appropriate.

From here you may configure additional conditions and settings in the respective tabs. When done, hit OK. Ensure the task is enabled and test it by running your target process and then locking your workstation.

1

In order to execute a task as the computer is locked or any such event, one method is to attach a Windows Scheduled task to a Windows Event Log entry. The Event log entry in question here for a workstation lock event is:

Event Log: Security

Event ID: 4800

Task Category: Other Logon/Logoff Events

To enable this Event log event to be created however, you must first enable the auditing of 'Other Logon/Logoff Events'. To do so you will need to launch the 'Local Security Policy' MMC Snap-in (secpol.msc). You can then enable, under the 'Advanced Audit Policy Configuration', the successful auditing of 'Audit Other Logon/Logoff Events', as shown below.

Local Security Policy

Once enabled, lock the computer and re-logging in. Then open the Windows Event log (eventvwr) to confirm the event has been logged. E.g.: Security Event Log

If you right-click on the Event log entry, choose 'Attach task to this event'. You can complete this wizard to create the task to run a batch file or script to kill a process.

To view the new task and make adjustments to it, launch the Task Scheduled MMC snap-in (taskschd.msc).
Event Viewer Tasks

Here you may wish to check the 'Conditions' tab of the task to ensure that the task runs when not connected to a power source for example. You may also want to check that it is set to 'Run with highest Privileges" on the 'General' tab depending on the process you are terminating.

In this example however, when setting up a new scheduled task, one of the built in triggers is: 'On workstation lock' so that is probably easier. The above answer hopefully provides some useful insight for the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.